What’s more, companies may also no longer rely on their external auditor to help correct an internal-control problem during the audit. Instead, they must correct any material weakness they identify before the audit, and test the fix beforehand. As a result, the “timing of the fixes is very dicey,” says Poss. Finance executives who fail to correct weaknesses in time will have no choice but to declare their controls ineffective.
That prospect should not be taken lightly, says Finn, given the close scrutiny that a failed controls audit would receive from the media, regulators, and plaintiffs’ attorneys. Still, he predicts, “we will inevitably see a number of adverse opinions,” and, possibly, attendant stock-price meltdowns, shareholder lawsuits, and SEC investigations.
Consequently, it behooves CFOs to understand not only their requirements, but also those of their auditors. In addition, they should be prepared to “move up more internal-control activities earlier in the year,” says Poss. Most important, says Wayne Avellanet, who recently authored a compliance manual for Section 404 (Warren, Gorham & Lamont, 2004), finance executives must come to grips with their own control systems. “If you are paying attention to your own organization,” says Avellanet, a divisional manager of internal control for SST Truck Co., “you will know where the problems are.” And, he adds, “if you can’t fix them, be honest about them.”
Lori Calabro is a deputy editor of CFO.
Paying the Piper
In announcing the new section 404 standards, Public Company Accounting Oversight Board (PCAOB) member Kayla Gillan warned auditors that the standards weren’t an excuse to “price gouge” clients. Yet audit fees are expected to climb 38 percent this year at Fortune 500 companies because of 404, according to Public Accounting Report newsletter. That’s on top of the increases that firms have already seen from overall Sarbanes-Oxley Act compliance.
In fact, the cost of Sarbox is just starting to be disclosed. In 2003, for example First Charter Corp., of Charlotte, North Carolina, saw its audit fees rise 37.5 percent. And General Electric Co. saw a similar increase — 40 percent — in large part because of work related to Sarbox and 404. CFO Keith Sherin expects to spend about the same amount this year to test all SEC registrants against the PCAOB standards. But unlike many other companies, GE was able to get an estimate on 404 costs up front from KPMG LLP.
Other companies haven’t been so fortunate. At Capital One Financial Corp., for example, CFO Gary Perlin says the firm has “not come to terms with what the fees are” in its arrangement with Ernst & Young. “We left that line blank,” he says, explaining that the final tab will depend on the “amount of individual testing” the auditor has to perform.
In hopes of limiting internal expenses, Capital One is educating and encouraging its business units to plan for their Section 404 testing requirements. Ultimately, says Perlin, “we will not pay centrally for any remediation. We will not subsidize poor management.” Yet he acknowledges that this won’t affect the overall tab much. In the end, he says, “there is no way to avoid paying the piper.”